[SOLVED] Scan stuck at smss.exe --> Removed left overs from third party software

If this is your first visit, be sure to
check out the FAQ by clicking the
link above. You may have to register
before you can post: click the register link above to proceed. To start viewing messages,
select the forum that you want to visit from the selection below.

1) Whenever I rebooted the PC, I got "Your Computer Is At Risk" and "Internet At Risk - Fix Now" warnings. Simple enough to fix, but a PITA.

2) More serious was this issue:
95% of the time, Quick and Normal and Deep Scans - Scheduled or Manual - DID NOT COMPLETE.

ALL of these scans tended to get stuck at C:\WINDOWS\System32\smss.exe.

Sometimes, when they got stuck whilst scanning my C:\ Drive, the attention of the scan briefly shifted to my external USB drive (J:\ Drive) - but after several hours of waiting at this juncture, the scan never progressed any further.

I tried unplugging the External HD (J:\ Drive) but no effect - the scans still stalled.

FYI: In between upgrading from 10.0.246.000 to 10.0.250.000, and again to 10.1.052.000, I completely cleansed my Hard Drive of erroneous / useless files and fragments, and defragged it - including the previously fragmented C:\$MFT file. And still NO luck.

After a few chats with the online Chat Support centre, from last Saturday through to last Tuesday, I was still NO closer to having a working piece of software, even after upgrading from 10.0.250.000 to 10.1.052.000 - although 10.1.052's associated ZA Browser Security / ZA Toolbar 1.5.336.0 does work with Firefox 7.0.1, whereas 10.0.250's 1.5.322.0 doesn't...

BTW, Two ZA Diagnostics Tool data dumps from 10.1.052.000 have been uploaded to ZA R&D over the past few days.

Whatever... ZA Online Chat Support have now told me to revert to the last known (in my instance) working piece of software - namely 0.246.

Please note the following:
I was running v.10.0.250.000 and 10.1.052.000 after a full ZA clean.exe, additional other cleaning protocols, a defrag and a re-install.

I am running a RAID 1 Mirror twin HD array on this PC - is this relevant?

I have an external USB Hard Drive on this PC. Is this relevant?

I have v.10.0.250.000 (fully licensed) running on two other PCs, which are SINGLE Hard Drive - with NO issues. Is this relevant?

After tonight's chat with ZA Online Chat Support, I have had to revert to running OLD ZASS software on this PC, until a fix can be found.

Re: Scan stuck at smss.exe with ZASS 10.0.250.000 and 10.1.052.000

Considering you have resolved your issue by installing an earlier version and as we can't really replace official support for these type of issues (collecting logs, escaleting, etc) I am closing this thread.

If you want to keep using the current build you can try as a workaround to simply exclude the problematic file(s), drivers or folders from the "on-demand" scanning by UNchecking them under ZA "Scan Target" (advance setting of the antivirus/antispyware section).

Do not hesitate to open a new thread for any other user based help needed or PM me in case you find a solution and want to update this thread. It may help other users with your same problem.

Re: Scan stuck at smss.exe ZASS 10 and 10.1

UPDATE:
OK – so I installed 10.0.246.000 as mentioned above. And that worked fine in Manual Scan modes (Quick, Normal, and Deep) from install. So I set a scheduled Normal scan for overnight, clicked “Update” to install the latest AV / AS database, and went to bed.

The following morning, and the scan that I had set to run overnight was still running, having scanned NO files (allegedly) and once again the “Pause” and “Cancel” buttons on the Scan Monitor window didn’t work. And so, once again I had to shutdown the ZASS program in order to stop the scan. I was back to square one…! GRRRR…!

Long story slightly short: I tried re-installing 10.0.246.000, and 10.0.250.000 and 10.1.052.000 – twice each! In between each install, I followed ZA’s instructions and removed ZASS via the XP “change or remove programs” function and then ran ZA’s Clean.exe.
I also ran Revo Uninstaller, CCleaner, and Raxco PerfectSpeed and PerfectDisc12. And finally I cleaned the Empty Space on my HD – quite a performance, but I needed to be 100% confident that I had no Registry hang-overs etc.
And every time that I installed a version of ZASS, it worked perfectly – Manual and Scheduled scans all ran.

But as soon as I updated the AV / AS database from the default install version to the latest version, ALL of the scans across ALL of the versions either ran endlessly (seemingly never scanning one file, let alone 100,000!) or they stalled at C:\WINDOWS\System32\smss.exe.

After many chats with ZA Online Support, and trials of many ideas (some of them completely “out there”!), we think that we’ve found a solution.

Install ZASS in the usual fashion.
Click Update (! YES, really!), and let the latest updates install.
Open ZASS from the taskbar.
Click “Tools”, click “Preferences”, and click “Reset To Default”.
You will then have to manually restart your PC.
Once restarted, Click “Update” again.

“Reset to Default” seems to dump the latest Anti-virus signature DAT file version and returns ZASS to the original downloaded program base version – but it does not seem to affect any other updates that were installed, such as the Anti-virus engine version number; AntiSpam version; ZoneAlarm Browser Security; ZoneAlarm ForceField Spyware Scanner; ZoneAlarm ForceField Anti-Phishing Database; or the ZoneAlarm ForceField Spyware Sites Database version number.

I had to complete the “Reset To Default” and “Update” twice – but now I have a working version of 10.1.052.000, complete with all of the latest AV / AS etc updates installed.

Incidentally, after “Resetting To Default” and then clicking “Update”, the updates took a VERY long time to be delivered and installed. Certainly 3 times longer than updating from a fresh install to the latest database versions without clicking through “Reset To Default”. I have an opinion on why this symptom occurs, and why it might be a good thing – but that’s all that it is – an opinion. So I’ll keep it to myself.

Re: Scan stuck at smss.exe ZASS 10 and 10.1

Btw, I am sure you did it but if not try to run ZASS isolated from all the rest of software you are using. I believe you have a clash between ZA and some of your third party software. This is also considering that just another user reported your same problem. If it was a generalised issue this board would be flooded with "me too" messages not just few.

It can be that all your registry and HD optimization tools have changed something on the system (OS setting, registry, etc) and now ZA is not able to work as it should. A suggestion from the future, stay away from them they are often creating more problems than the one they are designed to fix. Moreover the only way to fix their changes is a full format and reinstall of the OS. Better to count on native MS tools to touch your system or registry.

Probably a selective boot will not solve the problem but could be worth a try:

1.) Click Start -> Run
2.) Type MSConfig in the run box and click OK
3.) Once in MSConfig, click the Startup Tab
4.) Remove the checks from everything except ZLClient and forcefield
5.) Click the Services Tab
6.) Place a check in "Hide All Microsoft Services"
7.) Now remove checks from everything other than TrueVector Internet
Monitor and ForceField (if present), and click OK.
8.) Restart your computer

NOTE: You can place your computer back into a normal startup process by going back into msconfig and choosing the Normal Startup option on the General tab.

If the above fails also try to run the scan by booting with SAFE MODE with NETWORKING. Run manually ZA, firewall will not be functional, the scanner yes.

Also try to exclude the file(s), folder(s), driver(s) from the advance settings of the antivirus/antispyware section (Scan Target) and see if it just a busy file/HD sector.

Finally if all the above fails I am out of suggestion than reinstalling the system. I am sure its not the route you will like to follow.

Cheers,FaxPS. Merged your last post with your previous one, just to keep the thread short and easier to follow.

But - I can still run all 3 types of scan, either scheduled or manual, in Selective Boot or with all normal start-up programs and services running, using Anti-virus signature DAT file version: 1049404736.

I have also tried removing C:\WINDOWS\system32\smss.exe from the Scan Target area (quite a feat to locate that file via the tiny little window that ZA gives you in that page!).
Still no joy.
I suspect this is because the scan stalls whilst checking memory - and simply removing it as a target from the Hard Drive doesn't tell ZASS to ignore it, if it's in memory...

Interestingly, unchecking the "Scan System Memory" box option in the Scan Targets page stops the scans from even starting...! Just a dumb View Scan pop-up box with all times and files scanned showing zero. And once again, the "Pause" and "Cancel" buttons don't function. Hey-ho...

Finally, it's arguably pointless me running a scan in Safe mode with Networking, as I am not going to usually boot-up the PC or have it running in that mode normally.

So - I'm at a loss now frankly. And as I've spent over a week of my holiday chasing this issue, I've had enough and I'm close to calling it a day.

It's interesting that I can run the ZASS program with NO ISSUES, using a relatively recent AV database, but that I can't run the ZASS program using the latest AV database. Therefore, reformatting the HDs and reinstalling the OS is perhaps overkill - seeing as it's apparently not the program that is at fault but the AV database - IMHO.
I'd love to get my hands on a few different versions of the database, to see which was the last one that did work...! It might help to narrow-down the offending protocol...?

In any event, I have Online Support allegedly escalating this issue to a Manager on Monday. Who knows, I might actually get somewhere from that angle - get them to debug this program, rather than me.

But in the meantime, I've set all of my next scan times to the year 2020, as it's pointless the scans starting if they can't actually run.

I'll keep checking the program every other day as the next Database versions are released.

But if this issue isn't resolved in the next 124 days, I won't be renewing my 3-user licence for ZASS...a shame as I've been a loyal customer of ZA's for quite a number of years now.

Thanks again for your input guys - if you or anyone else has any bright (or even stupid!) ideas for me to try other courses of action not previously listed, please post them.
And if I get any success, I'll be straight back here to report.

Re: Scan stuck at smss.exe ZASS 10 and 10.1

Originally Posted by gelert

Finally, it's arguably pointless me running a scan in Safe mode with Networking, as I am not going to usually boot-up the PC or have it running in that mode normally.

Actually its not about you always scanning in safe mode but to test IF it works in SAFE MODE with Networking (***NOTE that ZA in normal safe mode will not work at all). If yes, then you will know that something running in normal mode (not system related) is blocking ZA. Please have a try and let us know.

Also, did ZA ever worked on that system before? If yes, what you have actually changed/installed/updated? Is your system multi OS boot? Running any OS emulator? Which version of ZA worked? Have you tried to reinstall it? Have you experienced any malware infections on the system? Have you checked your system as suggested here? Are you running or been running other security tools? I have seen these type of errors also on PC with other security tools left overs.

Here if I exclude the memory the scan starts normally with the HD(s), if in your case hangs then ZA has actually having difficulties reading the HD. Raid 1 is not an issue (I have the same setup). I suspect one of your magic HD optimization tools could have changed something and ZA cannot scan the HD. Try to see if manual mouse right click scan on "C" drive works. This may get around the issue on scanning your HD unreadable sectors also try to combine the UNchecking on "memory scan" with UNchecking "Scan boot sectors for all local drivers".

I am afraid but this look to me as a local issue. You never know but unlikely to be resolved by a ZA change.

Re: Scan stuck at smss.exe ZASS 10 and 10.1

Hi Fax.
You're like a dog with a bone...! Great stuff...!

OK, to answer your questions:Also, did ZA ever worked on that system before? Yes. V.10.0.246 & 10.0.250.If yes, what you have actually changed/installed/updated? Nothing.Is your system multi OS boot? NoRunning any OS emulator? NoWhich version of ZA worked? See above, up until about 01 October, when the scans started to run endlesly. 10.250 was installed months before that.Have you tried to reinstall it? Yes, several times. See details in my posts above.Have you experienced any malware infections on the system? NoHave you checked your system as suggested here? I run Malwarebytes on my system - have done for about 2 years. I scan with it once a month. Nothing found with it yesterday. Nothing found with Combofix yesterday either. *EDIT* Superantispyware and Emsisoft run successfully. Nothing significant found - just some tracking cookies.Are you running or been running other security tools? Yes - but nothing new. MBAM is the latest piece of security to be added (2 years ago!), other than ZASS. Usual database and program improvement updates to WinPatrol and SpywareBlaster, along with MBAM and ZASS. ZASS is the last program to have an updated version number, btw.I have seen these type of errors also on PC with other security tools left overs. So have I. Spybot S&D removed from my system recently, as the program is pretty redundant now IMHO.Try to see if manual mouse right click scan on "C" drive works. It does - running it now, with the latest updates of the AV database 1062694528 on ZASS 10.1.052.000. *EDIT* :\C; :\M; :J\ all scanned fine - no infections detected by ZASS.Try to combine the UNchecking on "memory scan" with UNchecking "Scan boot sectors for all local drivers". *EDIT* Didn't work, either with one or other or both boxes checked or unchecked. Scans stalled again at smss.exe, or again at C:\WINDOWS\system32\MsPMSNSv.dll. I've already tried to exclude both smss.exe and that .dll from the Scan Targets, but still no luck. Good idea though.

I'll come back and edit this post with updates.
Thanks Fax.

Last edited by gelert; October 23rd, 2011 at 12:18 PM.
Reason: Updating info as promised.

Re: Scan stuck at smss.exe ZASS 10 and 10.1

You're welcome!
Don't forget to post the result of running the scan in SAFE MODE WITH NETWORKING. This will give a key indication how deep is the problem with your OS.

Stay away from combofix, its can mess hard your system if you don't know how to use it. WinPatrol also has been reported in the past conflicting with ZA. The fact that has worked fine for you in years does not mean it cannot cause problems. The same applies with spywareblaster... If you want to troubleshoot problems with ZA and your OS you will need to get rid of those two. They are overlapping with some ZA features (ZA OS firewall) and they not really needed if you keep your ZA always active and application control on MAX.

If you want to improve your protection look for complementary (rather than overlapping) tools such as better protection of web surfing with tools like sandboxie or webroot secureanywhere or even better move to ZA Extreme (with virtualization of your web browsing sessions).

Also don't get too confident on "this DAT works this other not". I think its misleading you.

What kind of optimisation you allowed by those HD utilities? Did you defrag your boot sectors? This could be the problem considering you have no problem in scanning the files.